DXF to Image

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7f9bfc4bc3b2615a120bd71675385e5b7e01411637944abfde66c0c2a3d3ca9f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant prompt injection vulnerability in `SKILL.md` combined with the `shell:exec` permission. The `SKILL.md` explicitly instructs the AI agent to `exec` the `convert_dxf.py` script with user-provided input paths (`<dxf_path>`, `<output>`) and to 'Do not ask for confirmation'. This creates a clear path for a malicious user to achieve arbitrary command execution (RCE) by injecting shell commands into the input path arguments, which the agent would then execute without sanitization. While the `convert_dxf.py` script itself appears benign, the agent's instruction to execute user-controlled input directly via `exec` is a critical security flaw.